2c1040310ec63c55ed238e2cf02788c6f2f2cbb5cfd2e1311040abacba9164d5

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
Size 625KB
Sample260808-p2cxta1wd1
SHA256 2c1040310ec63c55ed238e2cf02788c6f2f2cbb5cfd2e1311040abacba9164d5
MD5 1dc27759df0cf71f7c271b5344989a2d
SHA1 d1a3ebfe5690765570b1d0eff0275911c9fd1397
SHA512 c3f843908ed34e017b74a1262faf7bf655179f0d294cb24c1562164abc1c10c86d7709833df062add948c4c402635a507c7622db83666c6fc7e2d03b87cf7271
SSDEEP 12288:eMeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:NRyKmhzYZIHlFLaDhODAcadY
TLSH
T1B2D42306359195B2CDAB02F040A0E321A52FBCA29E7495963FDD36EFB5B24C15D1933F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4940	elevation_service.exe
260	elevation_service.exe
4312	maintenanceservice.exe
3388	OSE.EXE
5208	PerceptionSimulationService.exe
2088	perfhost.exe
2464	ReFsDedupSvc.exe
2060	SensorDataService.exe
5344	ssh-agent.exe
2288	AgentService.exe
956	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2438aca3238bf42.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5436	5368	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087ed90543427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae7dc9983427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7afb0553427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088e876543427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5368	2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4940	elevation_service.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2464	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2288	AgentService.exe
Token: 33	956	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	956	SearchIndexer.exe
Token: SeDebugPrivilege	4940	elevation_service.exe
Token: SeDebugPrivilege	260	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4504	956	SearchIndexer.exe	104
PID 956 wrote to memory of 6104	956	SearchIndexer.exe	105
PID 956 wrote to memory of 3912	956	SearchIndexer.exe	106
PID 956 wrote to memory of 5228	956	SearchIndexer.exe	107
PID 956 wrote to memory of 4624	956	SearchIndexer.exe	111
PID 956 wrote to memory of 1324	956	SearchIndexer.exe	112
PID 956 wrote to memory of 1980	956	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1dc27759df0cf71f7c271b5344989a2d_elex_karagany_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 596
  2⤵
  - Program crash
  PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5368 -ip 5368
1⤵
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:260

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4312

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2060

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3534546789587d7f9d6533eeead34306bfa46b2a4df34112629fbcc148c73fd5
MD5 5d0e2afd2b805f2c1bee854653f1eb3b
SHA1 8ba1f0bba3c0061f4c55e0fbe042b06ec4b10bc2
SHA512 42755c97ad1e1ece35e8f8b33adde04c0a8c6f6e4370c1d3845e45d5f17d87cd86b5db839db208412cfb58d2c21fd18d626e2cd44a0b1d50f3e608de036b0864
SSDEEP 49152:Gb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn8Y3hzYQlFai:43q60jBByF0i
TLSH
T1C5D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e8af8064228894edac5fa36cc845411b240a95aaa85a3681cb6a5466ff496e02
MD5 001c3e2a9a566b3f6603afb43ee063d9
SHA1 bde463f65c36d78ecd57dc5697ec991b1b782813
SHA512 f8aac91ba22ef5408c4b35f2a0ad04be008263ff3d2f33a885eca2df73ba95d83eba2450f5d13a7d53753d0a499f20fabca744024a418e0c2a0273d707d52bff
SSDEEP 24576:rXYfDtczANRyKmhzYZIHlFLaDhODAcadY:utciY3hzYQlFai
TLSH
T11305F128739009F9DD6B817CC8A28511EA33BC514B60E7DB03E49A7A5F336D85E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fa8b578dd285fd53bb9383dff8d8ffc290b860638eab0580adee79688de62842
MD5 3c1a85799f562eb9de83b590ae1f2ea4
SHA1 8c473d798b84125195cf8c641e56ed0983264e2a
SHA512 c21977050bcb3efe8a30fc43bc938fdc86eec39bcdf0c321f672f8a7441deb45dfb28ab665fe571f37565b1277022d44cbb7316c7d02dc370bbd45e9dec43deb
SSDEEP 24576:V0Le5ji0hmxNrMQRyKmhzYZIHlFLaDhODAcadY:VPji0A7nY3hzYQlFai
TLSH
T13435AE16F6748331D073C0B9C5D2A69AED7130825B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f2b05ee5532cd64d668e7d7d9a2c7c49e84379f3fa24cc2adc92c9fa49e6d347
MD5 b55878d5a3169d5c64cc891811aa3d67
SHA1 f5be3a300f8fb6ba66a7f358a50834d2c146a8f1
SHA512 3d5439e13c8237b9e8ecbf52b176bc85711dd1bf7bba15602cacc945d46a09d0ef96b29eb8d31db1f127217d0070ca86b9e2aa13c2800bb81f75ea2c1b3df2c9
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWr6q8wyuuRyKmhzYZIHlFLaDhODAcadY:K/ezSC6vUzPviHjybY3hzYQlFai
TLSH
T13A756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b7ab6c37ee690220bb2de608ac07d37ad023b9c095c9ce3eb942d0f26f647433
MD5 593d8a5f8c92a02faf69831fcc1fcbf3
SHA1 297b938b968ac0ababfbd9c567f22b222f92e18e
SHA512 f00d422887030f4a2ed87dc00a8c1a0ebb1b11d00b80403fe00ef55f40626d7c8a987fbfc6568fabbf7fc2c230378e2e38be583f4beb2577c878ecda147bd66d
SSDEEP 24576:zVbqPb88hv/l+bZRyKmhzYZIHlFLaDhODAcadY:zVO88hXl+FY3hzYQlFai
TLSH
T150559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 43ddf73510f03f7681c660abdc0979ee05cf89be28284f5f5e134c9f89f0eb17
MD5 9b225bf6eacdd20299e2b83934fefda1
SHA1 ab0705d9a9ed2633f5c946364b70a4a6d73ef8f2
SHA512 5e0537930e8fd3fbd8f96c4585afd045d53ec4fa34380a1319da862dce76f21feae14b6ab699806a6604c91473c218316f8d2d37674baead5b0427a4f3271740
SSDEEP 12288:bjIeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:bjsRyKmhzYZIHlFLaDhODAcadY
TLSH
T101C4234921002AD2CFAF09F090E57250B52ADDA16D506D545EEB7BFFA1BA883DC0A53F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ded019a17a015de8c71dfeb0ec2a67c8ab4d682923118c759dd7697af4b62005
MD5 743525fa0e5647f695dc18e4c5ed9619
SHA1 209f7de0cfc401c2e3e8ffb7b5c6d12776cdfb84
SHA512 1e6892a2bbfd6d4b455c4225dc693b61e62f01f30e3b201237b3bd09dcd640f46db89105549c8ce7d006484666adb80710abc8183270dc2d7b62493edcc9bdf2
SSDEEP 12288:UeBNUbTVO86UpeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:UJIUBRyKmhzYZIHlFLaDhODAcadY
TLSH
T16E05CF3BAE28FCE2C67E4DB856918200E77278704F61A3CBD165834EDE235D15D7AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7e71203bf2c63cb057e277092a3916d71b0067500ce178c1e7ea6ec055ca90d2
MD5 4be6406d5fa91f7c7ffd2d5ea590665a
SHA1 d064e75aba4c1a4bdc27c0b9bb5f365b1e9582b2
SHA512 5f9ab3bd59d314728029824cdab434afedd607200119170f937047da479e9ea33ca0be45e9de25a84f60047609c654446934f66fb21c07ef131e523edcb18dda
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THs:qQvGAdlCEL8c/RRNw5CeyF0i
TLSH
T168267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 499764c693e09a9be81c104bc759c1f373f72eb5ae9d1abde7ff17f204df8657
MD5 54f5d3c88cfa45e0c24fb98b86a28e0e
SHA1 6e2475a0105a24f374da6fd56fdad81017f09d4a
SHA512 e748eb056102c739f17077835f072008b4c70c09250d573165c512f734f80cda239024afa028ace5aca647da1b3a6e5eab024a83eae78d2214874ab53c5dc338
SSDEEP 12288:2AwSfxL/2Dc3DDLLmt0LDQewsAjbeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtx:LSewsAjXRyKmhzYZIHlFLaDhODAcadY
TLSH
T17015E031FA74E432C7BF0DB21B26D716642DB9204F5129C3E3E85E9E59701C22776A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3dacc1050f81181942aa250c9bf0635d38ec2174ff517a35bed29670b4b02827
MD5 aef74c32b3203cb24778bf8f0fa4f3c7
SHA1 2dc96e255a5265348617b7e92e0d9285110560f4
SHA512 a3f6662685e4859a7470f1f264557d3115baf77bb4493958a186a228e881dc27352ae1dec389eaeae247282ade1b25539b056897a7f1ad6660405b8fa296d62a
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHPyF:bUEtQevvqc2W1cpV2RI32PG
TLSH
T122474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 84b90048c074825dcead4cbcaf907d7ca708b9d29203c8447d907761fd9f7a85
MD5 b5160a6e635031ab7a90ecff30b12695
SHA1 16339b55d015d693a5b70ba357186e883204b75d
SHA512 575f24ae9f757e2db1b1a2451cae7e77ee4f1724c267c0e84ee0bad7c0edf7b6d3d17ee1c972c7a664a90ebc8c9e8cb8d990504a4c9aeec80dcc91db0001f25a
SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/z3Y3hzYQlFai:noquVjnmiyF0i
TLSH
T1D7D58E0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a2983478e9a67a5672045fefae24c7aba7ede88882583123eac337049d3e2faf
MD5 ef1203823b04ce91d7fa8f38938a7ef5
SHA1 e40f273bb3be269e6346dac3c763427ecccdd3bb
SHA512 89cc949a8dfa804113fe70d60ebe890cc059831d01ba7ba0fff65b124ee6924ff4d00fbbb47a32adc8217cfe1cf3f8405b3ffa5fbc4db52f43fb8ef8a570c8a8
SSDEEP 24576:bAhGL2IFoiwtA5l7S53CRyKmhzYZIHlFLaDhODAcadY:bAM1Foiq5SY3hzYQlFai
TLSH
T1F9359D81E7F955D4F5B3AAB899B69170EA76BCA65E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7fd8fba644ccfbd72959477cd960eead27ced01d4e790ecc9e3496bf7f39fbc3
MD5 b0f2ef304f323cf1ef769de44d498368
SHA1 7be7c095d6ff9fc682365f0cf531230ba21593a7
SHA512 6d793ac651f0322f4e82129a5c9c1038ccc55babc70462e2f2ce5e1180fe0a61436e5bdfbd29419fa21448355bfeaa778fbc66378b5bdb77eead27632f35b897
SSDEEP 12288:Amw5HEjsChNSBFgl0WDm+COeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWF:dwuXOW7RyKmhzYZIHlFLaDhODAcadY
TLSH
T1A205F14A32A41CF9E9A74178C597D131F7B2BC112E21DB1F17A0C66B6F37251AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 243a6a8a3bff6f96f328eaf8bd04f0ad3adb3f1d8c09ecd92eb52e515673b9f5
MD5 73b29c5a2635df527d00a3bfe39838e9
SHA1 661f99a41df57bb5f1cfbf66ea1c5ff23716d8f7
SHA512 e9e14a9d452807c73a07f6db78c68e9544a0e2c9b911d594bd422836fddfe0b5e81f2d9d8f198707d50e622df77be3a0cfb858e112fb369a59339066ffe923de
SSDEEP 12288:K/Z1IyreURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:OZu4RyKmhzYZIHlFLaDhODAcadY
TLSH
T166E4124A329031F5C6AB42B8C4E15245E732BCA22F3153CF16A552BB6F739C25D3973A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6bb0c57f7a76d3a929dd357ffb7ef080392c1ce6760c5fd2cd16da6b7120d192
MD5 39c7d05055bf8cac3fb0752a2cb2c060
SHA1 49560edb724341ec2842bd7144f7721d6086773a
SHA512 17dbf886240aae7fec70377fa87c3e2974a22ede3828365b2a844f857ace4902a14c1a9dab4d409202ae489bf49c3c3c02880d7afa206d0110dc58daf9dd75f8
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U4:pQRQyi36YOcPhLvw2gAf+PN31yF0i
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a117b408ebf601386bf5034f05d15134e44e3e90cb5b36fc6a68261bb406303e
MD5 407ab1da0d86992363eb00cfce1c2d74
SHA1 3583b139ad6c12a81cc3c2acad44c15554a7a230
SHA512 7b8dc51bc17725a2013dd64e3f1b8743c92fc0873fbebaaa0a873b1b7ebcc44953148b08ce42b0500b49bc80aea16237528b537573fc0753ee1a1ddae7f306b3
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U4:tQRQyi36YOcPhLvw2gAf+PN31yF0i
TLSH
T13E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b81571e377b8ebcd3374db76d6a3b7ae0a70fa708047205c05dacff1c2cd786a
MD5 2e3812c74bd95c41ed8224226233f723
SHA1 52021328c6fe1551485f3a270838fae0a9cdb56c
SHA512 8683e5d76a8bc0728cba33311ad42bda033af7f03de91b98cfe4640e51e373c458bcd40104af01e8832e83a9102ce30b080094553005cbee7d0c4a637343d269
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0IRyKmhzYZIHlFL/:I68Qg55nhceWu7PNU3/nY3hzYQlFai
TLSH
T1A0B55A33B2F200A9C44DE1769F46973196D27C718FE0E3DB8515721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b0a2b4cf203b9d83a24aafc6710b6403d3331e7f87ece850f042ff0fdce570c0
MD5 45f0381649cc0223bce3c148f674d28c
SHA1 8bd3f75c77133c56d537d172483de64c40fa9b15
SHA512 f657143aea3d45ead84b48300b289a5752be45928326c7160df0831fa18f6dcee493a14531d1cf515add491db7355f9f839851c93e64e6dc762f7a3d1bb51b2b
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99+:ny5112gYy5azzVva69nLKnhZsyF0i
TLSH
T111167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9dd29614339e12831c269d234cf0cec198610094f83b9dce03c6f866ad8a681f
MD5 b439e5fe40c433e019f3759cea7948d1
SHA1 35c3f73a5e83b67d9f82e5c4b94a7c7d2175cfb2
SHA512 ee606c6108e634e255144a96375084c379bcb8170346efc710cfcaf31e9ab1302a82d8e2e5c86e66a0dc29c3d887d9adf51d176cd7d16d1b4a755cd68339e870
SSDEEP 49152:PB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl9Y3hzYQlFai:xu6JmUxd2d9yF0i
TLSH
T13BD59D13F1DA01E8D06ED478974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8ecfd91113de420f7213b5ddcd7566d4bc93aadde992b1a130fcf5679383fbc4
MD5 3c3058b69f3197f6995801264a1473a9
SHA1 110e1d5ab8c53805ae5393ac084bdc5a5c8b878c
SHA512 76223bfd59dd27d61e4f83eafcd5dc979621b1bad731e232c333eb7102d3f86f34f783c68fb41648167ee0f43cbba028f41749d5e1f8288ae0aa6adf61f84ced
SSDEEP 49152:t1hpsNoJpF1A6BU44CwH7R4xhY3hzYQlFai:tmifPkRiyF0i
TLSH
T138B5BE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 05a9c37c7db86d744afbcea1c73a101a29da5596dddb030632365c5e185f055d
MD5 16d1d0fbf2ea9265f017c12351af2590
SHA1 cea961d50e688f520cffc0f778f397afbfbe6c7c
SHA512 f13c6dbc111c2363281aa6ed28bf5e820c46a57a9d88ac71263eec07a3b30501dc507a92f23d54a2244e43b318f55b99cb1d3abb88f0523e89fd2e22ec9bc4cd
SSDEEP 49152:dSuZQIY0Be2KNRVtOnks6NMHq4Y3hzYQlFai:z5dKvi614yF0i
TLSH
T161C5BE03F2E941E8E0BED67487669232EA72BC464F34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 56f74eb5d2b6b28316275fcd91952ef03b9347e39bd84ba9475ece2fa5740d1a
MD5 e48c2b034ed2abdcc4f31c75ad4eb470
SHA1 3db1d41dbef996bccb20d5e8833b1cd96b2e9acd
SHA512 b4414b7f5b677ec242a466e049b57bfb89cd40424590267b166c1b0365abbfc4898fde15831433378e067942dd2d5998975cdb4b404c0de2b75ea27044bbec9e
SSDEEP 49152:AhtSn8EApI0figXgiDn0AP5wNY3hzYQlFai:RX2iyph2yF0i
TLSH
T1E095BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1a5316434340c2552256c816eff9617355466de9189c0cc119b4ec09b418a01e
MD5 8fff82639fa4027e9596eeca3ac6f09e
SHA1 4f60d3e8145191d009316695c6659efd5a9e3b3d
SHA512 b0e0c6bdc5eab4b0a9900c59c9f3c2d3c552051cdfcfe34aa4e89c7151c0892bff3e878bd6692583c87d93362884e0e84ba7aefaad10a42369e2ec4f0f785c66
SSDEEP 12288:WQeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:W0RyKmhzYZIHlFLaDhODAcadY
TLSH
T105C4234930512BD6CA9E09F080917354F41DDDA27E5129A87FEF36BBB2B68835C0A93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fa15d6a6a5285b332dc8ed5e8d7cfa5524b4ae568d0c37a49f7d30c9e654ee8d
MD5 8dff4c0b5bf3cc20b27748460d4c6e0b
SHA1 34d8ed5222e9f2b2574f4ee1ebe1e486a8ed1748
SHA512 c8b619627ef01d34bb3cf89211564fe83411b124593b47afceca18354560546b1167963d2e7385194b39d80c0d00751fb5de481ef4c4a607450bf995b4a84e5e
SSDEEP 12288:G/eURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:GTRyKmhzYZIHlFLaDhODAcadY
TLSH
T1DDC4234934512BD2CA9E05F080917350F41DDDA27D5129A83FEF76BBB2B68835C0E93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 97ac5137a977825586431a24b5b421b716abf018a485019e66b6216d9372d6b4
MD5 8adab9236c338c1fd3acf1e6a868eb31
SHA1 4fe57cc367e18cb58e1478e62accf61f9fd0ba9b
SHA512 c3b653f0c1ba6d2c17832c57224cef11ed4fa2d0543ed523732ca05f1ec8bd7e7516537749eb396c4d862cf367015d2ede14f0b529fd22d2f6086d7d357093c8
SSDEEP 12288:LxeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:LpRyKmhzYZIHlFLaDhODAcadY
TLSH
T16FC4234934112BD6CA9E09F080917390F419DDA27D5129A87FEF76BBB2B78835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 5afd29d428eb0db11d718a40c8b14c9462b1a27b26de26589c9c4426449fc4eb
MD5 8c4662b78dbfea37af9bdf34cff8fb04
SHA1 62af3453a8f4db7c1d65557362a03fb55f3fd594
SHA512 a77ac410f293b6a3bffe5097a2ef7cdc86389f1decf494b56c902ec28ee66816d332699f390484839411514cb8a3b8777a2a22c4506c7fa57b642b179d754686
SSDEEP 12288:AVKeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:xRyKmhzYZIHlFLaDhODAcadY
TLSH
T12BD42305325116D2CDAB86F4C0A16250F139FCE17F2166DF6F9626BF2AB24826C19F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d8cc1614f013fa11dafc9747383af5172fc859cc9ca9e95e390364e78136b4a1
MD5 5e42a007eeea4ab9a5e94ad60e5e1074
SHA1 1eefd92de8e006e701a313c163743656d6538b53
SHA512 b07e8a297a5e0f2c04a46cab5242dda11103ac52643fd2d6c93e7b2698486d206727fbc9fcae5c719ff2811cdecb58c0d3055eaea16f71c394a29cf1262ece95
SSDEEP 12288:dieURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:daRyKmhzYZIHlFLaDhODAcadY
TLSH
T19EC4234934512BD6CA9E09F080917390F41DDDA27D5129A87FEF36BBB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 51dadd3acde3d992afec1cc0a3395ef6fc70db85a7927f28416e8ebafb8c4143
MD5 6ce7671d9ae2b54834d55d5ec535e51f
SHA1 288f166c0eb7cf121c0149191d3caf30ad47d827
SHA512 4f7d8f9aed3773aab11fc31af6543cbd5836b70ee55193d1800bf98199e747fd696b5089d044fd93a10175e2354a960c536b84110a1f44b66b268505a2dd7053
SSDEEP 12288:BjeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:B/RyKmhzYZIHlFLaDhODAcadY
TLSH
T141C4234934512BD2CA9E09F080917394F41DDDA27D5125A83FEF76BBB2B68835C0E93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6b2c97ee8852cce9191c5e99756e224ba0bf0ac191c8ee1b2c8e2fa20a5b893d
MD5 b2c3e5d778a02bcc0bc8027cca13314c
SHA1 2895ba6caa216319eacff6d674f831af996dab38
SHA512 73a54b57ea621407f705761845e182d56806ddca73b26429fdc05db1bacf1937576313ff897371aeafe6eb6a988b8025251859fa432d09655d141bbdf67930f4
SSDEEP 12288:dXeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:dLRyKmhzYZIHlFLaDhODAcadY
TLSH
T11AC4234930512BD2CA9E05F080917350F41DDDA27D5129A87FEF76BBB2B68836C0E93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 99a9fea9f29bc3fcf422e9c06efff133ac2a49fd1aa30c915b37ee7edad7ec7a
MD5 9a3848048d926869888f22455706688f
SHA1 a67e4ed525e13fecc28ead676c281fde14fc4f5e
SHA512 a12dede437b8b8d52eebd855ee22a06b78c4d95bd9c60bbe50ba0f48b319ef4ff4c49b033fdd685b58dd843fa5a0581c3a7e8525bac765375d31c72233c241ae
SSDEEP 24576:bZMMzFVSOzRyKmhzYZIHlFLaDhODAcadY:bZMMzfvY3hzYQlFai
TLSH
T147050195735018F4DCA7827EC8619905E6B2BC5A0B60C61F13F8366B6F733911C2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9c3f9a49ae1b4d51387ed40d83ac756d14efb075bb634ad36b9ef5d05735ce3b
MD5 b8689731026631ee7046f894c24c12f2
SHA1 a60f52a44bc1edbc797e8d238e28140350b7b039
SHA512 81ecfb84a3ace18e94e9a4a7d3392e8421ccf927bd98677b24c9a4fcff410f0e727dc45ed37938a84afd3c92be85d5fb11de96dad0a2ba5bec3af86982b8f5c3
SSDEEP 12288:EMeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:EoRyKmhzYZIHlFLaDhODAcadY
TLSH
T190C4234930112AD2CA9E09F080916390F81DDDA67D5129987FEF36BFB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 41ad6f86b8290ac4fac050ff0b50073684d1a01e73e5b9b12a1472b1da10de00
MD5 be0b5f3a60cecd77044598b4482478a6
SHA1 a787f1aa31db3c7c22b7574cf1c6ad68287a5545
SHA512 0972500ab8bd28f96e4232f1c3ea57dfb3e0e7e1a0dfed24103f0605d0728dd25019fbb3cdb4abd8a95dea1c4ca84fdec64fe368ae496819e4f8e9f799180dea
SSDEEP 12288:eYeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:ecRyKmhzYZIHlFLaDhODAcadY
TLSH
T1F6C4234930512BD2CE9E05F080917394F41DDDA27D5125A87FAF76BBB2B68835C0E93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 735ae6c435a0a1955e54f3ddf51e8591e2d6b1e997092fdd663585f99ac8f002
MD5 5b2a05796dcba540f27f8df5f9025b11
SHA1 5b8e6ce6e9ebcc36925c435683909404a3b4543b
SHA512 438b10ce248cae302496a3def2dbf51b48290fcc6b74048ab28718e3bc50ac0ff69df89df8ffb0c3645ea4b92bc02abafec8e853a7a4634f11107bba2f46f5c3
SSDEEP 12288:byPz5L8reURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:WzyHRyKmhzYZIHlFLaDhODAcadY
TLSH
T128F4020732A131F9C56B8274C8A21601F776BC721F209AAF17A417BB2F775919D2EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 1e04f9123acd9fb8f2e39717f85769dbee767a1facb38cc0d8455e6e5ce914e0
MD5 64ebbc42d5a3e8598395f779c88ef915
SHA1 838692a784ca100664b5fb05f40a3eb869a52036
SHA512 db7e80e938642da53a977debbb4dd50fc3a08711394bb0a810f02c0820a2c2ac67dcc4b14c73341ff3f94fa4789233a754e182fc8ce647d1199458d2f504b14e
SSDEEP 12288:xMeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:xoRyKmhzYZIHlFLaDhODAcadY
TLSH
T16CC4234930112AD6CA9E09F080917390F81DDDA67D5129987FEF76BFB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5e55ab67ce353a7a80fc607fe1fa06a469be2da2db46d79527c2473e7aa3d02c
MD5 1efd72c527c1ea750a2a13662692e4f7
SHA1 f9b89784e413c7caeb417827e68a702df3021293
SHA512 649e8113cc6f71d9a406643455fbe359d52c22fe1663a6e8589fe0fc51484f3cbf3a91d6d2eb31e5b73bbd32e2282d255c39e838f5f16e28c85dd855e64e778a
SSDEEP 12288:PMeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:PoRyKmhzYZIHlFLaDhODAcadY
TLSH
T1FBC4234930112AD2CA9E09F080917394F81DDDA67D5129986FEF36BFB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 dbfa20a1f4b854a1626f5ea39d8bc5e84444067c2a4aea774b7297908990ef92
MD5 476af2531680228320c167aa36850f22
SHA1 5ecaf462bdfd471b480fabc87ec8b0f618ab906a
SHA512 52854f5a82326e86f56d2f19b39efdb68549503077a6fb2ea968c48c2d147133acca376d00b8de95ed38b3191ed03927924f0f10733b3d7d44d8803297488a9c
SSDEEP 12288:iyPz5L8reURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:/zyHRyKmhzYZIHlFLaDhODAcadY
TLSH
T15FF4020732A131F9C56B8274C8A21601F776BC721F209AAF17A417BB2F775919D2EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3652e0aee7a13ce40ab087da1c1b8a28009d3993419bb2d3dd6705f57d7b0d8b
MD5 fa77e21a0673d0214ede56de1cd5c196
SHA1 0da17749e2e94b48d52da2a11bac60a53ac27286
SHA512 9cf752d669a09896e278bbb0c13378384a7027373e778516452a0386f4c129ae3445faffa3123a3bbe440f6bf2bd0a4edd541233156e9e1330258f902581454b
SSDEEP 24576:TT9aLl3z0zD5RyKmhzYZIHlFLaDhODAcadY:TTQLljuY3hzYQlFai
TLSH
T11B05019473501CF8DC67817EC8659906D2B2BC6A0B70CA5F17F8366B5F332911C2EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ca3094bc93f347f74ce22b651d7e88e593fecca2a9c47cba75ceedc2170c95e7
MD5 f0af1c8e8d791db2506e7e4d1d6e4f81
SHA1 483265eeb5d469ae4ba348d8b6f49665d6d68d7e
SHA512 3b1347d90c493460b38acfaad91a6f87b773ab91c26cbb4d083f02167f866b583972184aba2185a900111ac26985c0ba5cb09985964833e58986401b4ad432d2
SSDEEP 24576:W3td9CHKy7GZVRyKmhzYZIHlFLaDhODAcadY:4td9CHKyavY3hzYQlFai
TLSH
T10525CF90B3E414E4F0B78A75C8765511DA767C9A1B31DE8F03A8266A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 21f12c3e67aa3667aac82b444d8fa0a004998f2e396564a49239e04ab2d3321c
MD5 6a1e07422aaae936a3983c0b80fd7e8b
SHA1 0d211fcd53feae8ba2cf5e05332016f7e6e40b9f
SHA512 6c9a4aee8cb19e4bf7fb5c565f0570128012ccc614a86c9a7754caf973c74778ebdcf63fad280b0b2a1db27dd729d19c9523739d476470ae961917508ca4b6e2
SSDEEP 12288:1ReURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:1JRyKmhzYZIHlFLaDhODAcadY
TLSH
T156C4234934112BD6CA9E09F080917390F41DDDA27D5129A87FEF76BBB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5828a8126dfde3dab20e8714f10ab7459fd3c08a1258318e873013645cf3e985
MD5 84d9347c9a4a84b9ae3dd18576ea473e
SHA1 dbd227ddaf7444c89ab06060520205c2f8739499
SHA512 c9765c5c795923ced52a4e0ef88f33de7d329470107242b8d65a674333667a092e17e58fcefa1b8d2128244ae26222f1a7e5448bda79f4a6f7e33e1c2a713dfd
SSDEEP 12288:WLeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:WnRyKmhzYZIHlFLaDhODAcadY
TLSH
T19AC4234930512BE6CE9E05F080E56350F41DDDA27D5129987FEF36BBB2B68835C0A93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 dfc5a03f50716948815c80f21f62af5fdb898bde2446c5cfe4dc19ed9d2517d7
MD5 e470fe654974a32a719154184c75cdbd
SHA1 678c241f04f30ba60cfef0b4dcdc2a6d9823c6b7
SHA512 36ab7d3b3202822b855a2a439c80e5fd95d99971bee605dde0b5364e764514fe99553aff0079ab991cd14d65c22503476ea32c91a9a3543e7f02f0a80d6c1a62
SSDEEP 12288:RmeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:RmRyKmhzYZIHlFLaDhODAcadY
TLSH
T154C4234930112BD2CA9E09F480916390F81DDDA67D5129997FEF36BFB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c1b4ae732fac0a19efd651557482f43ecc41fdc477ba7792e3ec8cd8f814f4bd
MD5 0fd74535c6b816e97904b107b9bf2daf
SHA1 de89c83d27c8c79db849f549c6d79806e63de864
SHA512 dfab51e9f31120346adaf0d52f51ce033978d58b1a6b9a20626ce04da59f1d1a62dee9fc37f088c586d37cb51169d7921a9b397199cfb145f1f43ac10284982c
SSDEEP 12288:mMeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:moRyKmhzYZIHlFLaDhODAcadY
TLSH
T1C6C4234930112BD6CA9E09F080916394F81DDDA67D5129987FEF36BFB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 056656f44bee866c947cc64aa7f22461f0212e4732cf396db77adfd9bb2c0331
MD5 1d0cced4fd66a4a7b4ee11fb74be91b1
SHA1 ce23c8238802beb39f9dd043c4ef95c57e0b5196
SHA512 32e24ce868bf651919736532526d6a9da46d2a3901fddc6e31252d86feffcc94b3df962960fb86fa5a074db5b4065d4358410716a4e49346df06cf557b8931c7
SSDEEP 12288:6ReURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:6JRyKmhzYZIHlFLaDhODAcadY
TLSH
T12FC4234930112BD6CA9E09F180916390F41DDDA27D5129A87FEF76BFB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 484da9292c301afa80915a9b539a39177ffbdfba4194bfa429e16cb85b5d2442
MD5 5add41240e4af0f63fdabed6dd11adf0
SHA1 b2eeaf2b4edf9b723ba91ff7bdee3ffa5d543722
SHA512 bed7bf6959e8f8381c3292f7efc99e88e28d65ed9767a392ee45144bc21b52280b8b2e9a2c0b91761d1fb0dd33ed8938685763ba7af511dea3eb4d1b3a16b0d7
SSDEEP 12288:+keURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:+gRyKmhzYZIHlFLaDhODAcadY
TLSH
T13DC4234934112BD6CA9E09F180D16350F81DDDA27D5129987FEF36BFB2B68835C0A93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 629ecc7c98ecdae78b7e9052175cfb0387219c42ab80921644645be5cfe4b9e8
MD5 3b03ac30cd182b7069a7652b9e2a6e62
SHA1 0a2a5aedd93e0f2349d18ac2f5abd23b75e6884f
SHA512 a7926f5cb4de0b2766a7b7520a3ba3e85eb28560daf8642b8df2a725162211ed9abfb8fefec982f9b2e312be052d9c606ef6c8cef777543c0ba624e5be5bd886
SSDEEP 12288:qieURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:qaRyKmhzYZIHlFLaDhODAcadY
TLSH
T116C4234934112BD2CA9E09F080917390F429DDA27D5129997FEF76BBB2B68835C0E93D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 28d47afcea8687b8584652ec128ad7b1e2ad2be50ecc63d3bdd445a71b4cfa66
MD5 4a997ea51d2b88068e18ab2d4ec0012e
SHA1 c94df697f7c6ed8c5e69baced8208d25f1481373
SHA512 6caa40bdf9642037c3419cba7b3e1a9aa250e0409299cfe4f443264aea8a7cca3410542e5a4e54449315a487d822ad81c34f9856addce8d1d7973b91977d158e
SSDEEP 24576:Yfwvok9RX6wkyAIMRyKmhzYZIHlFLaDhODAcadY:AMnYIMY3hzYQlFai
TLSH
T10C35D029EBD804E5E1B7917C88B3460AF6B178691F31C6CF129A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9109490a0061495168b1edb0d73675b04d071e73b8f8479f7603a4a1987938e9
MD5 760c1b38a8a0f02994bff2e384baa54b
SHA1 adc07d87a1cfee1eb49adb9b79ca3008ae265252
SHA512 bb28580309eb65f138fe13665a497ee7d84078c8b5477dcad6c1823cfa69dba7c1c04e2e9026f212373069422a7134ffc4af71e6433d287829aacbbc79a9f785
SSDEEP 49152:OYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tY3hzYQlFai:aySzPVyF0i
TLSH
T189066C96A16801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1bdf366095d2549eaf5e169acfa097824962bd805a0465c4a3d325fc0c6018d1
MD5 aec25a6ebd63aa748ae29d5755af834a
SHA1 7090dc324d9d6a71b1db5aa8fdb5b3791569c99c
SHA512 daa898899c823d570d714d0008e7ad967c5a59766d5b9e7aea18a79147144cd19e9109c1a4ac55dd81c707f7dbbc5328311bedfa7e784c2056db106ab9b15915
SSDEEP 24576:O47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYjRyKmhzYZIHlFLaDhODAcadY:O47JUQj4irIhCnDHUPfF/dY3hzYQlFai
TLSH
T1B065AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 953a498065d6989350dffd71e7b9756aa8686b57ae7b7517509cdc690bcb9406
MD5 c072dbf9f1660e5a3ace1a47b27169e1
SHA1 93462bfc9a37f0958a149821d4bc0ae0f157d542
SHA512 392226cce6afdd6369319749f058192ce9cb895055cb5d0e7cdb3caa980079db239807f0fd346a6e68ee138718f14ad70d8736207500dead1cd851a8b2d8edde
SSDEEP 12288:kGsf8eURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:84RyKmhzYZIHlFLaDhODAcadY
TLSH
T19EE4F00AE29402E8C0AE52B5C3925640F3377C619BE1A3CB26D0F57F1F765819DEAB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 20b09267f469451dfb0c4529a220ae4457fb6b9e13522f5a1a3d539c8bd24ee8
MD5 d5be6b7bd99e865e32b0227f7f7f06d5
SHA1 e9f2ccd4d12f13245e37d27875bf675b6f386d81
SHA512 ef20f3d1e48f99a8ebd8133c54be9b122f0572db34ff02ad1aa9498ea22770c771a67c36372df9b54b4f6acf56debe5a6ae83b44b2560bdceaaa669559824cc3
SSDEEP 12288:Rj4VDy5mhvLwgyjUap3bdtDMjGXOcCaUVL:RQDRSc8b/D2GXFN
TLSH
T180353910B66BD75FC6A940325E37D6CCA7707D01FE459B0372C8872FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6910c9a5700a3dd7e3de3f84749c23e5a4f052d335886e68bdf1b987b00cd9ba
MD5 a8ebea8035332408f14eefc886c29902
SHA1 b789c21d06fe44ef1a0d948ffccc64431a604da1
SHA512 cd7e5b74cef5eb1abebc42f8aa573a1bce963d099ccb8242fac78860b8c057a9d7c6863ac0344c3971cd339f2ead7936af8d0f2e16b8f3d973126af13f186627
SSDEEP 6144:nZVD6VAnirAth4aXkAFeFB8aT8qBjsgBhcKDexHGcKDexHBADOtVv/hRHzs:J497+AKhRI
TLSH
T1E255C7816137E38BD1F76071072AAB4DAB68ED07B7095F2673C8053AC86B75290BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 813b3b3caa6271d523c12e37c3289ae315fd47bba8e7ed19d0f0cd4c73341615
MD5 776b4d7f81285161db2969aad9c7dd1b
SHA1 b8231c9e2f304ff9e5a176cc47bab49a5a3a00ef
SHA512 b95f3d645a7bb745955cf88fc3992b92574b83ff5735a09e94e0fd6420c17800efbc1915deaf41da31a27cf8c048ebf5b3b87e982c004e7f49af61d6e5e8b70e
SSDEEP 12288:Y07UeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:1wRyKmhzYZIHlFLaDhODAcadY
TLSH
T1AAD4230522446AD2CDBE06F04095A220B51EEDA16F5064D77E9B33FFB1B6CC25C29A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1dd41891a15ec7f5d422534a1f1d63a69bd87960355383f594578827099dcb27
MD5 8538a41df118c84b403138966e400d1b
SHA1 8c4ca41cc89011fea42bae2d1e1a13290454cadb
SHA512 8c931f1b997985db951acd1a281b45549f286228a63e80cb1277d06a37a2c6a43a1b94dc80d1ea1ee2d7f0152a467eb876ec6362d870c4f07cfafafce5c0a9e0
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYuRyKmhzYZIHlFLaDhODAcadY:cgb4mBIBhGFjY3hzYQlFai
TLSH
T15765AE1E22E802F5E0FAD2B8CDA64417D6B278161731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4d9c55f55045109651a0e7c15d8951dd0c0e34fe49815c9e9b7cb964f4bc6b99
MD5 fb0d91524bbd08447084084eab0f62d0
SHA1 c37ad051aefbf1f322f169fe2827e0f10bd4e60a
SHA512 2a71a87198e6cd8273c0c763327bca8454f100e4f63ab8e06ae23d2dd64749fcaafbcacde68c90053e69e777945732a106967d539cb235d00a51704b60659f85
SSDEEP 24576:yG88u8FpJqH1Wzria7/mzRyKmhzYZIHlFLaDhODAcadY:p7ZFPqVha7/GY3hzYQlFai
TLSH
T1C835F16576E102F1D47BD13889824663F6B2B8211760EFDF07A88B561F33AD14B3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3eb194909ec870a8c304297c96a00d6c18018c3e50a6487798f34ce0e3c9c54b
MD5 dc2680794e62252f3e83eae95f83111a
SHA1 0252643fccc0483657a6642003060bcee7d33ad3
SHA512 90cd4e540dd5b1c187a117e04770ec20d4d304e2b4b0851e593f1298de64abc0c8b2cffa4216cf7608c77448a8688c7d6199dccfc6bb427391b1ac8491cc9575
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/Y3hzYQlFai:+G05lO43bkyF0i
TLSH
T1A4D5CF6E62EC11F9D1BBC17CD9C6460BEBB23825032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0443632e83b9d988c497d45261441f0bc2aa15dc9bdc4890f41e97f48fbbcf08
MD5 5a039abae7bf7cb5705cd5088293cea2
SHA1 1b9c85390f0490deb177328d9f1cd0527bc8eb31
SHA512 5a7c43b24d5db1401110bb04b3df536951ba74ad96768ffb2f75d93ff7069b7369eb742e06f50ac50c8063210fc6fc47f27f79788d01f0c3d37d17f66723dbbe
SSDEEP 24576:Cfa5POZ3dpqWVM50JicR2hG0lasx2+47eidntRyKmhzYZIHlFLaDhODAcadY:Ka5POZ39Jt2pasx2+mnY3hzYQlFai
TLSH
T1FA65BF5EA6F801D5D5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 53405510889dd7aaba48f1a940aa38aea749bb6b0ac2b53b1f5d5ec3c317be42
MD5 6d3cc06d9be25e69d96bd7052f4810e5
SHA1 6e4043b4aa5e23ed8c176227d3b75929358f1943
SHA512 e522186ee3179a303f3c0008349cee89e98a3202b3268fc5dd8dae51084b8540b1c0eec7370f28ace2e606efce1e9df8ef3945109bc5cf8f27ee664a07bdb9e6
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkbRyKmhzYZIHlFLaDhODAcadY:+Nc/zEOVHFmY3hzYQlFai
TLSH
T143858C1623E901E4E5BBE1BE89779646FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d7033ce39aa3b74f950f12665e2fb8426cd906296dc2714cfd153436a2e6c89c
MD5 45344b784f7035b715aee00ac3a84141
SHA1 66cf51922eec6d4268099c9e3efaecd121428334
SHA512 3a7207e5334dc06f1f5ad9d33f43751d8899dc9da9739a8f0913de526db1cfe1d687364f237009c0dd25fa5e9074b5a59db9327d375f048a3390aec432b30d6f
SSDEEP 24576:0tkNvNnaFeYhJNtmZBmJRyKmhzYZIHlFLaDhODAcadY:0tMwBtOmJY3hzYQlFai
TLSH
T19855AF6EB6B806E4D1FEC6B4CD238512F6727861173292CB5290C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 df89ba7d76fd25dec3b1e71875e5e5689765f1a4116f399a0b5e2e73d7897ee0
MD5 bd1bf1f72c4eecc5ff03cc2a5d35c0cf
SHA1 baae2b77c0f64696ed370d29312dd83795230883
SHA512 244fd99e0fdc5f13087d2214d17c0fb49a6a4ca308f35fd3bb43a5871fc8c1fd62130939e54c8a6354e2f70a9163158dc752b7645a3232afbf7d7bf3e1418d58
SSDEEP 12288:/HvUrBFrEjwaQzeURysbmneYzYEQFIHlUEe9UFZaD4WG7/DAtGaKxWYa:/PUr+NQvRyKmhzYZIHlFLaDhODAcadY
TLSH
T1C405E11F22A818E5E67AA17D85828319F771B8621711A2CF02E1817F5F77DD8BC3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 c899126c0f13153f04e92d0f3f34b10fd778a0c9f06f37a2d2b75ebf5e11b5b3
MD5 1a5dcd07e8d2e9ec32d07e274d90344b
SHA1 2dcb6b57a4bb93112aec8e94bf7db31e81f2cc78
SHA512 71834f49ccf6c853b029ec271c3155f28ec10b9a0d8b7837897e6c3d933b399b505924afd25826e82d0ba05ae20dd5f93c14417049714f17f059b230149e9613
SSDEEP 24576:hD3FHshBIYQgAURyKmhzYZIHlFLaDhODAcadY:hDVHeBIAAUY3hzYQlFai
TLSH
T17425E13EE65804E4D57BC1BCC6A38606E77138A9072266CB06D491BA1F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/260-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/260-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/260-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/260-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/956-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/956-322-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/956-323-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/956-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/956-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2060-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2060-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2060-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2060-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2060-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2060-311-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2088-307-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2088-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2288-122-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2288-134-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2288-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2288-130-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2288-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2464-86-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2464-92-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2464-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2464-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2464-346-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2464-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3388-305-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3388-60-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3388-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3388-66-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3912-334-0x000001ECD8A40000-0x000001ECD8BC3000-memory.dmp

Download

memory/3912-421-0x000001ECD8A40000-0x000001ECD8BC3000-memory.dmp

Download

memory/4312-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4312-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4312-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4312-42-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4312-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4312-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4940-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4940-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4940-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4940-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4940-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5208-72-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5208-306-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5208-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5208-78-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5344-112-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5344-118-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5344-111-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5344-310-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5368-40-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5368-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5368-1-0x0000000000BB0000-0x0000000000C16000-memory.dmp

Download

memory/5368-7-0x0000000000BB0000-0x0000000000C16000-memory.dmp

Download

memory/5368-6-0x0000000000BB0000-0x0000000000C16000-memory.dmp

Download